The invention relates in general to the field of user trusted devices enabling computers to boot therefrom, as well as related devices, systems and methods.
A technology is needed, which would allow software to be executed on any non-previously prepared or reviewed computer (e.g., an employee's private PCs) while ensuring that its execution is secure, e.g., as secure as on a corporate/company PC. Such a technology would enable a trusted “bring your own” (BYO) computing work environment. BYO generally relates to “Bring your own device” (BYOD), “bring your own technology” (BYOT), or closely related, “bring your own behavior” (BYOB). BYOD or BYOT concerns corporate/business policy of how employees can bring and use personal mobile devices at work and access employers' email, databases and files, while otherwise using such devices at home, whereby personal applications/data are accessed though the same devices. Beyond hardware, BYOB extends this to software used on the device.
Today it is known that any software executed on a computer may be under attack by a number of viruses and malicious softwares (malware) that may be present on the PC's operating system. One solution for this problem is to restart a PC from an external boot media, e.g., stored on a user-trusted device, typically a secure device, and start a new and—from a security perspective—clean operating system (OS) from the external media.
However, this approach raises notably one significant technical drawback, as present inventors have realized, which the present invention aims at resolving.
Besides, external boot media are often provided on trusted devices (including secure, tamper proof devices), which type of devices is generally known. For example, for online transactions, a solution which has been developed is the so-called Zone Trusted Information Channel (or ZTIC for short). The ZTIC is a secure, non-programmable device for the authentication of transaction data. Since the ZTIC maintains a secured end-to-end network connection to the server, the ZTIC itself is tamper-proof against malicious software attacks and as it has its own input and output components independent of the host it connects to, the data shown on the ZTIC display is genuine. More details can be found in e.g., “The Zurich Trusted Information Channel—An Efficient Defence against Man-in-the-Middle and Malicious Software Attacks”, by Thomas Weigold, Thorsten Kramp, Reto Hermann, Frank Horing, Peter Buhler, Michael Baentsch. In P. Lipp, A.-R. Sadeghi, and K.-M. Koch (Eds.): TRUST 2008, LNCS 4968, pp. 75-91, 2008. Springer-Verlag Berlin Heidelberg 2008.